feat: Terraform Foundation - AWS Landing Zone

Enterprise-grade multi-tenant AWS cloud foundation.

Modules:
- GitHub OIDC for keyless CI/CD authentication
- IAM account settings and security baseline
- AWS Config Rules for compliance
- ABAC (Attribute-Based Access Control)
- SCPs (Service Control Policies)

Features:
- Multi-account architecture
- Cost optimization patterns
- Security best practices
- Comprehensive documentation

Tech: Terraform, AWS Organizations, IAM Identity Center

terraform/modules/tenant-security-group/README.md

@@ -0,0 +1,51 @@
+# tenant-security-group
+
+Tenant Security Group Module Creates isolated security groups for tenant workloads in shared VPC }
+
+## Usage
+
+```hcl
+module "tenant_security_group" {
+  source = "../modules/tenant-security-group"
+  
+  # Required variables
+  tenant = ""
+  environment = ""
+  vpc_id = ""
+
+  # Optional: see variables.tf for all options
+}
+```
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 1.5.0 |
+| aws | >= 5.0 |
+
+## Inputs
+
+| Name | Description | Type | Required |
+|------|-------------|------|----------|
+| tenant | Tenant identifier | `string` | yes |
+| environment | Environment (prod, staging, dev) | `string` | yes |
+| vpc_id | VPC ID for the security groups | `string` | yes |
+| create_web_sg | Create web tier security group | `bool` | no |
+| create_app_sg | Create app tier security group | `bool` | no |
+| create_db_sg | Create database tier security group | `bool` | no |
+| app_port | Application port | `number` | no |
+| db_port | Database port | `number` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| base_sg_id |  |
+| web_sg_id |  |
+| app_sg_id |  |
+| db_sg_id |  |
+
+## License
+
+Apache 2.0 - See LICENSE for details.